zaragoza444
5229c2d888
Some checks failed
CI/CD Pipeline / Solidity Contracts (push) Failing after 1m13s
CI/CD Pipeline / Lint and Format (push) Has been cancelled
CI/CD Pipeline / Security Scanning (push) Has been cancelled
CI/CD Pipeline / Terraform Validation (push) Has been cancelled
CI/CD Pipeline / Kubernetes Validation (push) Has been cancelled
Deploy ChainID 138 / Deploy ChainID 138 (push) Has been cancelled
HYBX OMNL TypeScript & anchor / token-aggregation build + reconcile artifact (push) Has been cancelled
Validation / validate-genesis (push) Has been cancelled
Validation / validate-terraform (push) Has been cancelled
Validation / validate-kubernetes (push) Has been cancelled
Validation / validate-smart-contracts (push) Has been cancelled
Validation / validate-security (push) Has been cancelled
Validation / validate-documentation (push) Has been cancelled
Verify Deployment / Verify Deployment (push) Has been cancelled
Exempt dashboard read APIs from anonymous rate limits, preserve nginx-injected auth, wire chain-mint and DB env through deploy/LXC scripts, resolve M3 token addresses from registry, and harden super-admin seeding. Co-authored-by: Cursor <cursoragent@cursor.com>
49 lines
1.7 KiB
TypeScript
49 lines
1.7 KiB
TypeScript
export type OmnlAuthRole = 'super_admin' | 'customer' | 'portal_internal' | 'legacy_operator';
|
|
export type OmnlPrincipal = {
|
|
role: OmnlAuthRole;
|
|
adminId?: string;
|
|
portalCtid?: number;
|
|
scopes?: string[];
|
|
};
|
|
export type SuperAdminEntry = {
|
|
id: string;
|
|
username: string;
|
|
email?: string;
|
|
displayName: string;
|
|
portalCtid: number;
|
|
portalName: string;
|
|
envKey: string;
|
|
fineractUser: string;
|
|
products: string[];
|
|
};
|
|
export type CustomerSecurityPolicy = {
|
|
version: string;
|
|
production: boolean;
|
|
neverExposeOperatorKeyInBrowser: boolean;
|
|
portalInjectAuthViaNginx: boolean;
|
|
requireApiKeyAllExchangeRoutes: boolean;
|
|
customerAllowedScopes: string[];
|
|
superAdminOnlyScopes: string[];
|
|
rateLimits: {
|
|
customerPerMinute: number;
|
|
superAdminPerMinute: number;
|
|
anonymousPerMinute: number;
|
|
};
|
|
publicEndpoints?: string[];
|
|
corsOrigins: string[];
|
|
};
|
|
export declare function loadSuperAdminRegistry(): SuperAdminEntry[];
|
|
export declare function extractApiKey(req: {
|
|
headers: Record<string, unknown>;
|
|
query?: Record<string, unknown>;
|
|
}): string | undefined;
|
|
export declare function loadCustomerSecurityPolicy(): CustomerSecurityPolicy;
|
|
export declare function resolveOmnlPrincipal(req: {
|
|
headers: Record<string, unknown>;
|
|
query?: Record<string, unknown>;
|
|
}, key?: string): OmnlPrincipal | null;
|
|
export declare function principalHasScope(principal: OmnlPrincipal | null, scope: string): boolean;
|
|
export declare function isProductionSecurityMode(): boolean;
|
|
/** Paths on settlement/exchange routers that skip anonymous rate limits (dashboard read APIs). */
|
|
export declare function isOmnlPublicEndpoint(pathname: string): boolean;
|